refactor: migrate from Codeberg to Gitea and rename rhemawave to radiantwave

- Update all Codeberg URLs to gitea.radiantwavetech.com/RadiantWaveTech/
- Rename flake inputs: rhemawave → radiantwave, rhemawave-dev → radiantwave-dev
- Rename NixOS configs: rhemawavekiosk* → radiantwavekiosk*
- Update systemd services, data paths, and binary references
- Rename plymouth theme files
- Update CI workflow, documentation, and build scripts

AGENTS.md

@@ -2,9 +2,9 @@
 
 ## What this repo is
 
-NixOS flake that defines kiosk systems running the RadiantWave app. Not application code — this is the OS image and deployment configuration. The actual app lives in the `rhemawave` flake input (from Codeberg).
+NixOS flake that defines kiosk systems running the RadiantWave app. Not application code — this is the OS image and deployment configuration. The actual app lives in the `radiantwave` flake input (from gitea.radiantwavetech.com).
 
-Hosted on Codeberg: `https://codeberg.org/RhemaWave-Technologies/KioskConfig`
+Hosted on Gitea: `https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig`
 
 ## Key commands
 
@@ -29,32 +29,32 @@ nix eval .#nixosConfigurations --apply builtins.attrNames
 
 | Name | Target hardware | Disk device | Notes |
 |---|---|---|---|
-| `rhemawavekiosk` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Production, uses `rhemawave` main |
-| `rhemawavekiosk-dev` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Dev, uses `rhemawave-dev` ref |
-| `rhemawavekiosk-commercial` | Commercial HW (SATA) | `/dev/sda` | Production |
-| `rhemawavekiosk-commercial-dev` | Commercial HW (SATA) | `/dev/sda` | Dev |
-| `rhemawavekiosk-android` | Intel NUC 14 | `/dev/nvme0n1` | + rotated display (portrait) |
-| `rhemawavekiosk-rpi` | Raspberry Pi 5 | — | Uses `nixos-raspberrypi` |
-| `rhemawavekiosk-rpi-dev` | Raspberry Pi 5 | — | Dev, uses `rhemawave-dev` |
+| `radiantwavekiosk` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Production, uses `radiantwave` main |
+| `radiantwavekiosk-dev` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | Dev, uses `radiantwave-dev` ref |
+| `radiantwavekiosk-commercial` | Commercial HW (SATA) | `/dev/sda` | Production |
+| `radiantwavekiosk-commercial-dev` | Commercial HW (SATA) | `/dev/sda` | Dev |
+| `radiantwavekiosk-android` | Intel NUC 14 | `/dev/nvme0n1` | + rotated display (portrait) |
+| `radiantwavekiosk-rpi` | Raspberry Pi 5 | — | Uses `nixos-raspberrypi` |
+| `radiantwavekiosk-rpi-dev` | Raspberry Pi 5 | — | Dev, uses `radiantwave-dev` |
 
 ISOs: `usb-iso`, `commercial-usb-iso`, `android-iso`, `dev-iso` — each bakes in the corresponding system closure for zero-touch install.
 
 ## Branching model
 
-Single branch (`main`). Production vs. dev split is at the **flake input** level (`rhemawave` vs `rhemawave-dev`), not at the branch level.
+Single branch (`main`). Production vs. dev split is at the **flake input** level (`radiantwave` vs `radiantwave-dev`), not at the branch level.
 
 ## CI (Forgejo)
 
-`.forgejo/workflows/build-dev.yml` — triggered by `repository_dispatch` (`radiantwave-dev-built`) from the RadiantWave repo. Updates `rhemawave-dev` input, builds dev closure + ISO, commits updated `flake.lock`. Runs on `neils-server-runner`.
+`.forgejo/workflows/build-dev.yml` — triggered by `repository_dispatch` (`radiantwave-dev-built`) from the RadiantWave repo. Updates `radiantwave-dev` input, builds dev closure + ISO, commits updated `flake.lock`. Runs on `neils-server-runner`.
 
 ## Important gotchas
 
 - **Disk device differs by variant**: `disk-config.nix` uses `/dev/nvme0n1`, `commercial-disk-config.nix` uses `/dev/sda`. Don't mix them up.
-- **ISO configs reference specific system closures**: `iso-config.nix` hardcodes `rhemawavekiosk`, `dev-iso.nix` hardcodes `rhemawavekiosk-dev`, `commercial-iso-config.nix` hardcodes `rhemawavekiosk-commercial`. Changing a config name in `flake.nix` requires updating the corresponding ISO config.
+- **ISO configs reference specific system closures**: `iso-config.nix` hardcodes `radiantwavekiosk`, `dev-iso.nix` hardcodes `radiantwavekiosk-dev`, `commercial-iso-config.nix` hardcodes `radiantwavekiosk-commercial`. Changing a config name in `flake.nix` requires updating the corresponding ISO config.
 - **Attic cache token**: ISO configs embed a JWT token for Attic in `/etc/nix/netrc`. If builds fail with auth errors, the token may have expired (expiry in the JWT payload).
 - **`rotated_display.nix` uses `mkForce`** on `loginShellInit` — it replaces the entire kiosk startup script from `configuration.nix`, don't edit both.
 - **SOPS**: `.sops.yaml` configures age-based encryption for `secrets.yaml`. You'll need the private key matching `age1t2wpzv...` to decrypt.
-- **Flake inputs**: `rhemawave` tracks main, `rhemawave-dev` tracks `?ref=dev`. Updating them independently is intentional.
+- **Flake inputs**: `radiantwave` tracks main, `radiantwave-dev` tracks `?ref=dev`. Updating them independently is intentional.
 
 ## File map